Refining Indirect Call Targets at the Binary Level
Sun Hyoung Kim, Cong Sun, Dongrui Zeng, Gang Tan · 2021
Enforcing fine-grained Control-Flow Integrity (CFI) is critical for increasing software security.However, for commercial off-the-shelf (COTS) binaries, constructing highprecision Control-Flow Graphs (CFGs) is challenging, because there is no source-level information, such as symbols and types, to assist in indirect-branch target inference.The lack of sourcelevel information brings extra challenges to inferring targets for indirect calls compared to other kinds of indirect branches.Points-to analysis could be a promising solution for this problem, but there is no practical points-to analysis framework for inferring indirect call targets at the binary level.Value set analysis (VSA) is the state-of-the-art binary-level points-to analysis but does not scale to large programs.It is also highly conservative by design and thus leads to low-precision CFG construction.In this paper, we present a binary-level points-to analysis framework called BPA to construct sound and high-precision CFGs.It is a new way of performing points-to analysis at the binary level with the focus on resolving indirect call targets.BPA employs several major techniques, including assuming a block memory model and a memory access analysis for partitioning memory into blocks, to achieve a better balance between scalability and precision.In evaluation, we demonstrate that BPA achieves a 34.5% precision improvement rate over the current state-of-theart technique without introducing false negatives.